The ELSTER "tax refund" that steals your bank details
An email with the ELSTER logo announces an income-tax refund — often a precise, believable amount — and asks you to "confirm your bank details" via a link. The linked page is a convincing copy of the tax portal that harvests your bank and ID data. Sender addresses are look-alikes: one documented wave used eister.de — an "i" instead of the "l" in elster.de. Finance ministries warned about these campaigns repeatedly through 2025–2026.
The one fact that defuses every version: ELSTER and the Finanzamt never announce refunds by email and never ask for bank data via a link. Real tax mail arrives in your ELSTER inbox or by post.
What to do: delete refund emails. If you're unsure, type elster.de yourself (or ask your tax advisor) and look in your inbox there — anything real will be waiting; anything not there doesn't exist.
Threat examples
Tap the outlined parts of the message to see the red flags
Official notice regarding your income tax: you are entitled to a refund of €221.50. To receive payment, please confirm your bank details within 5 days: [confirmation link]